gitnexus 1.6.8-rc.8 → 1.6.8

package/dist/core/ingestion/workers/parse-worker.js

@@ -11,15 +11,17 @@ import Go from 'tree-sitter-go';
 import Rust from 'tree-sitter-rust';
 import PHP from 'tree-sitter-php';
 import Ruby from 'tree-sitter-ruby';
-import { createRequire } from 'node:module';
+import { requireVendoredGrammar } from '../../tree-sitter/vendored-grammars.js';
 import { SupportedLanguages } from '../../../_shared/index.js';
 import { getProvider } from '../languages/index.js';
 import { getTreeSitterBufferSize, getTreeSitterContentByteLength, TREE_SITTER_MAX_BUFFER, } from '../constants.js';
 import { ARRAY_METHOD_HOC_BLOCKLIST_SET, DEFAULT_EXPORT_IDENTIFIER_BLOCKLIST_SET, deriveDefaultExportHocName, } from '../ts-js-hoc-utils.js';
 import { parseSourceSafe } from '../../tree-sitter/safe-parse.js';
+import { postResultCloneSafe } from './post-result.js';
+import { mergeResult } from './result-merge.js';
 // ── Worker grammar loading — enforcement boundary (#2091/#2093, #2101) ───────
-// The worker maintains its own grammar table (the guarded `_require`s below +
-// `languageMap`) and intentionally does NOT consult the runtime
+// The worker maintains its own grammar table (the guarded vendored-grammar
+// loads below + `languageMap`) and intentionally does NOT consult the runtime
 // `GITNEXUS_SKIP_OPTIONAL_GRAMMARS` opt-out. It does not need to: the MAIN
 // THREAD's `parseableScanned` filter (pipeline-phases/parse-impl.ts, gated on
 // `parser-loader.isLanguageAvailable`, which honors the runtime opt-out and a
@@ -30,33 +32,29 @@ import { parseSourceSafe } from '../../tree-sitter/safe-parse.js';
 // `isLanguageAvailable` must re-introduce the gate here. (The cleaner end-state
 // — routing this table through `parser-loader.getLanguageGrammar` so there is
 // one loader — is the deferred Tier-1 consolidation.)
-// tree-sitter-swift is an optionalDependency — may not be installed
-const _require = createRequire(import.meta.url);
+// Swift/Dart/Kotlin/C are vendored grammars loaded from `vendor/` by absolute
+// path (NEVER copied into node_modules — see vendored-grammars.ts / #2111). Each
+// may be absent on a platform without a prebuild or a toolchain-less /
+// `--ignore-scripts` install, so every load is guarded so a missing binding
+// cannot crash the worker at module-load (#2091/#2093, #2116).
 let Swift = null;
 try {
-    Swift = _require('tree-sitter-swift');
+    Swift = requireVendoredGrammar('tree-sitter-swift');
 }
 catch { }
-// tree-sitter-dart is an optionalDependency — may not be installed
 let Dart = null;
 try {
-    Dart = _require('tree-sitter-dart');
+    Dart = requireVendoredGrammar('tree-sitter-dart');
 }
 catch { }
-// tree-sitter-kotlin is an optionalDependency — may not be installed
 let Kotlin = null;
 try {
-    Kotlin = _require('tree-sitter-kotlin');
+    Kotlin = requireVendoredGrammar('tree-sitter-kotlin');
 }
 catch { }
-// tree-sitter-c is now vendored prebuild-only (#2116) and may be absent on a
-// toolchain-less / `--ignore-scripts` install. Guard it like Swift/Dart/Kotlin so
-// a missing binding cannot crash the worker at module-load (#2091/#2093); the
-// main-thread `isLanguageAvailable` filter keeps C files from being dispatched
-// here when the entry is absent.
 let C = null;
 try {
-    C = _require('tree-sitter-c');
+    C = requireVendoredGrammar('tree-sitter-c');
 }
 catch { }
 import { getLanguageFromFilename } from '../../../_shared/index.js';
@@ -71,6 +69,7 @@ import { extractTemplateArguments, templateArgumentsIdTag, templateConstraintsId
 import { extractParsedFile } from '../scope-extractor-bridge.js';
 import { persistParsedFileShardSync, persistDurableParsedFileShardSync, } from '../../../storage/parsedfile-store.js';
 import { extractLaravelRoutes } from '../route-extractors/laravel.js';
+import { collectFunctionCfgs, DEFAULT_PDG_MAX_FUNCTION_LINES, } from '../cfg/collect.js';
 import { logger } from '../../logger.js';
 // ── ParsedFile store (#1983 parallel serialization) ─────────────────────────
 // Read ONCE at worker init from `workerData` (immutable for the run, inherited
@@ -88,6 +87,17 @@ const PARSED_FILE_STORE_STORAGE_PATH = workerData?.parsedFileStoreStoragePath;
 // restores them without re-parsing. `undefined` ⇒ no durable write.
 const DURABLE_PARSED_FILE_STORAGE_PATH = workerData?.durableParsedFileStoragePath;
 let shardSeq = 0;
+// ── PDG/CFG opt-in (#2081 M1) ───────────────────────────────────────────────
+// Read ONCE at worker init from `workerData` (the worker never sees
+// PipelineOptions — config arrives via the pool factory's `workerData`, see
+// KTD7 / U5). When `pdg` is set, the worker builds a per-function control-flow
+// graph from the tree-sitter AST (where it lives) and serializes it onto
+// `ParsedFile.cfgSideChannel`. Off ⇒ no CFG work and no field — the default for
+// every run today. `pdgMaxFunctionLines` bounds per-function CFG cost
+// (0/undefined ⇒ no cap; see collectFunctionCfgs).
+const PDG_ENABLED = workerData?.pdg === true;
+const PDG_MAX_FUNCTION_LINES = workerData?.pdgMaxFunctionLines ??
+    DEFAULT_PDG_MAX_FUNCTION_LINES;
 // ── Bootstrap-stage diagnostics (#1741) ────────────────────────────────────
 // When GITNEXUS_WORKER_BOOTSTRAP=1 (or --verbose sets GITNEXUS_VERBOSE), each
 // worker reports its startup stage timings to stderr — which the pool tees
@@ -501,6 +511,7 @@ const processBatch = (files, onProgress) => {
         fileScopeBindings: [],
         parsedFiles: [],
         skippedLanguages: {},
+        cfgSkipped: {},
         fileCount: 0,
     };
     // Group by language to minimize setLanguage calls
@@ -835,7 +846,52 @@ const processFileGroup = (files, language, queryString, result, onFileProcessed)
             // copy — scopes/defs are carried by reference) to attach the field rather
             // than mutate the frozen object.
             const sideChannel = provider.collectCaptureSideChannel?.(file.path);
-            result.parsedFiles.push(sideChannel !== undefined ? { ...parsedFile, captureSideChannel: sideChannel } : parsedFile);
+            let withChannels = sideChannel !== undefined ? { ...parsedFile, captureSideChannel: sideChannel } : parsedFile;
+            // CFG side-channel (#2081 M1): build the per-function control-flow graph
+            // here, where the tree-sitter AST is still in hand, and attach it as plain
+            // serializable data. Only on a --pdg run and only for languages with a
+            // cfgVisitor (TS/JS in M1). The same disk-store/warm-cache machinery that
+            // carries captureSideChannel carries this — its coherence rests on the
+            // SCHEMA_BUMP + the pdg-folded chunk-hash key (see parse-cache.ts).
+            if (PDG_ENABLED && provider.cfgVisitor) {
+                // Isolate the CFG build per file: a throw here (an unexpected tree-sitter
+                // node shape) must NOT propagate — it would escape processFileGroup to the
+                // language-group catch, which treats any throw as "parser unavailable" and
+                // silently drops EVERY remaining file in the group. Skip CFG for this one
+                // file; parsing + scope resolution proceed unaffected (CFG is a
+                // strictly-additive opt-in). collectFunctionCfgs ALSO isolates per
+                // FUNCTION now (#2195) — a deep-nesting bail or a single malformed function
+                // is counted in `skipped` and skipped, not allowed to lose the whole file.
+                try {
+                    const { cfgs, skipped } = collectFunctionCfgs(tree.rootNode, provider.cfgVisitor, file.path, PDG_MAX_FUNCTION_LINES, 
+                    // Embedded scripts (Vue SFC <script>) parse at row 0 but live at
+                    // `lineOffset` in the file — shift the CFG into file coordinates so
+                    // it joins its graph node and BasicBlock lines map to source.
+                    lineOffset);
+                    if (cfgs.length)
+                        withChannels = { ...withChannels, cfgSideChannel: cfgs };
+                    // Surface per-function CFG skips per-language (#2195): merged + logged
+                    // in mergeChunkResults. Only accumulate when something was skipped so
+                    // the common (nothing-skipped) case stays a no-op.
+                    if (skipped.tooManyLines || skipped.tooDeeplyNested || skipped.buildError) {
+                        const agg = (result.cfgSkipped ??= {});
+                        const prev = agg[language] ?? { tooManyLines: 0, tooDeeplyNested: 0, buildError: 0 };
+                        agg[language] = {
+                            tooManyLines: prev.tooManyLines + skipped.tooManyLines,
+                            tooDeeplyNested: prev.tooDeeplyNested + skipped.tooDeeplyNested,
+                            buildError: prev.buildError + skipped.buildError,
+                        };
+                    }
+                }
+                catch (err) {
+                    const message = `CFG build failed for ${file.path}: ${err instanceof Error ? err.message : String(err)}`;
+                    if (parentPort)
+                        parentPort.postMessage({ type: 'warning', message });
+                    else
+                        logger.warn(message);
+                }
+            }
+            result.parsedFiles.push(withChannels);
         }
         // Build per-file type environment + constructor bindings in a single AST walk.
         // The legacy heritage pre-pass that seeded a file-local parentMap for
@@ -1675,6 +1731,9 @@ const processFileGroup = (files, language, queryString, result, onFileProcessed)
                 isReadonly: methodProps.isReadonly,
                 isAbstract: methodProps.isAbstract,
                 isFinal: methodProps.isFinal,
+                ...(methodProps.isDeleted !== undefined
+                    ? { isDeleted: methodProps.isDeleted }
+                    : {}),
                 ...(methodProps.isVirtual !== undefined
                     ? { isVirtual: methodProps.isVirtual }
                     : {}),
@@ -1790,44 +1849,12 @@ let accumulated = {
     fileScopeBindings: [],
     parsedFiles: [],
     skippedLanguages: {},
+    cfgSkipped: {},
     fileCount: 0,
 };
 let cumulativeProcessed = 0;
-// Use a loop instead of push(...spread) to avoid hitting V8's argument limit
-// when merging large result sets (push(...arr) calls apply() under the hood
-// and blows the stack when arr has >~65k elements).
-const appendAll = (target, src) => {
-    for (let i = 0; i < src.length; i++)
-        target.push(src[i]);
-};
-const mergeResult = (target, src) => {
-    appendAll(target.nodes, src.nodes);
-    appendAll(target.relationships, src.relationships);
-    appendAll(target.symbols, src.symbols);
-    appendAll(target.calls, src.calls);
-    appendAll(target.assignments, src.assignments);
-    appendAll(target.routes, src.routes);
-    appendAll(target.fetchCalls, src.fetchCalls);
-    appendAll(target.fetchWrapperDefs, src.fetchWrapperDefs);
-    appendAll(target.decoratorRoutes, src.decoratorRoutes);
-    if (src.routerIncludes)
-        appendAll(target.routerIncludes, src.routerIncludes);
-    if (src.routerImports)
-        appendAll(target.routerImports, src.routerImports);
-    if (src.routerModuleAliases) {
-        target.routerModuleAliases ??= [];
-        appendAll(target.routerModuleAliases, src.routerModuleAliases);
-    }
-    appendAll(target.toolDefs, src.toolDefs);
-    appendAll(target.ormQueries, src.ormQueries);
-    appendAll(target.constructorBindings, src.constructorBindings);
-    appendAll(target.fileScopeBindings, src.fileScopeBindings);
-    appendAll(target.parsedFiles, src.parsedFiles);
-    for (const [lang, count] of Object.entries(src.skippedLanguages)) {
-        target.skippedLanguages[lang] = (target.skippedLanguages[lang] || 0) + count;
-    }
-    target.fileCount += src.fileCount;
-};
+// `mergeResult` (+ its `appendAll`) lives in ./result-merge.ts (extracted so it
+// can be unit-tested without importing this entry module).
 // Signal the pool that worker-side initialization (parser imports, language
 // grammars, type-env setup, all helper modules) is complete and the message
 // handler below is about to be attached. The pool's `waitForWorkerReady`
@@ -1920,7 +1947,7 @@ parentPort.on('message', (msg) => {
                     accumulated.parsedFiles = [];
                 }
             }
-            parentPort.postMessage({ type: 'result', data: accumulated });
+            postResultCloneSafe(accumulated);
             // Reset for potential reuse
             accumulated = {
                 nodes: [],
@@ -1941,6 +1968,7 @@ parentPort.on('message', (msg) => {
                 fileScopeBindings: [],
                 parsedFiles: [],
                 skippedLanguages: {},
+                cfgSkipped: {},
                 fileCount: 0,
             };
             cumulativeProcessed = 0;

package/dist/core/ingestion/workers/post-result.d.ts

@@ -0,0 +1,22 @@
+import type { ParseWorkerResult } from './parse-worker.js';
+/**
+ * Deliver the accumulated result to the pool, surviving a non-cloneable value
+ * (#2112). Fast path: post as-is — on a healthy result this is the only thing
+ * that runs, so clone-safety adds zero overhead to normal runs. If structured
+ * clone rejects the payload (a function/symbol leaked into an extraction
+ * record — the reporter's case was a node `properties` value pointing at a
+ * native `toString`), rewrite the boundary-crossing arrays so the result is
+ * cloneable, record the affected paths on `result.skippedPaths`, warn the
+ * operator naming the offending field + file (so the still-unpinned leak is
+ * diagnosable from logs and fixable at source), and re-post.
+ *
+ * Recovery is attempted for ANY first-post failure, not only a `DataCloneError`.
+ * structuredClone invokes getters, and a getter that THROWS surfaces its own
+ * error (a `RangeError`, etc.) — NOT a `DataCloneError` (confirmed against a
+ * real MessageChannel). Gating recovery on `DataCloneError` let such a throw
+ * re-throw past the sanitizer and re-arm, under `POOL_SIZE=1`, the worker-death
+ * cascade this net prevents. The recovery path is wrapped in its own try/catch
+ * so a still-uncloneable re-post fails closed to a primitive-only
+ * `{type:'error'}` DELIBERATELY rather than escaping the worker.
+ */
+export declare function postResultCloneSafe(result: ParseWorkerResult): void;

package/dist/core/ingestion/workers/post-result.js

@@ -0,0 +1,87 @@
+/**
+ * Worker → main result delivery with clone-safety (#2112).
+ *
+ * Extracted from `parse-worker.ts` into its own side-effect-free module so it
+ * can be imported and exercised directly (the parse worker is an entry module:
+ * importing it would construct the parser, post `ready`, and attach the real
+ * message handler). The integration test imports `postResultCloneSafe` from
+ * here to cover the production wiring end to end rather than re-implementing it.
+ */
+import { parentPort } from 'node:worker_threads';
+import { makeWorkerResultCloneSafe } from './clone-safety.js';
+/**
+ * Strict mode (opt-in via `GITNEXUS_STRICT_CLONE=1`, inherited by workers). When
+ * on, a clone failure THROWS with the offending key path instead of silently
+ * sanitizing + delivering — so a leak introduced by a future provider/extractor
+ * change fails LOUDLY (in CI / dev) at its origin rather than being quietly
+ * stripped in production. The silent-recovery behavior is exactly what hid the
+ * original #2112 leak; strict mode removes the silence where we want loudness.
+ * Off in production, where the net's job is to keep the run alive.
+ */
+const STRICT_CLONE = process.env.GITNEXUS_STRICT_CLONE === '1';
+/**
+ * Deliver the accumulated result to the pool, surviving a non-cloneable value
+ * (#2112). Fast path: post as-is — on a healthy result this is the only thing
+ * that runs, so clone-safety adds zero overhead to normal runs. If structured
+ * clone rejects the payload (a function/symbol leaked into an extraction
+ * record — the reporter's case was a node `properties` value pointing at a
+ * native `toString`), rewrite the boundary-crossing arrays so the result is
+ * cloneable, record the affected paths on `result.skippedPaths`, warn the
+ * operator naming the offending field + file (so the still-unpinned leak is
+ * diagnosable from logs and fixable at source), and re-post.
+ *
+ * Recovery is attempted for ANY first-post failure, not only a `DataCloneError`.
+ * structuredClone invokes getters, and a getter that THROWS surfaces its own
+ * error (a `RangeError`, etc.) — NOT a `DataCloneError` (confirmed against a
+ * real MessageChannel). Gating recovery on `DataCloneError` let such a throw
+ * re-throw past the sanitizer and re-arm, under `POOL_SIZE=1`, the worker-death
+ * cascade this net prevents. The recovery path is wrapped in its own try/catch
+ * so a still-uncloneable re-post fails closed to a primitive-only
+ * `{type:'error'}` DELIBERATELY rather than escaping the worker.
+ */
+export function postResultCloneSafe(result) {
+    try {
+        parentPort.postMessage({ type: 'result', data: result });
+        return;
+    }
+    catch {
+        // Fall through to recovery on ANY failure (DataCloneError OR a throwing
+        // getter's own error). A healthy post returned above and never reaches here.
+    }
+    try {
+        // `as unknown as Record<string, unknown>` is the standard widening for a
+        // no-index-signature interface (TS rejects a single-step `as`). The field
+        // sets are typed to `keyof ParseWorkerResult` so renaming a field is a
+        // compile error here, not a silent loss of the drop-whole / skip protection.
+        const { skipped } = makeWorkerResultCloneSafe(result, {
+            dropWholeElement: new Set(['parsedFiles']),
+            skipFields: new Set(['skippedPaths']),
+        });
+        if (skipped.length > 0) {
+            if (STRICT_CLONE) {
+                // Surface the leak loudly with its exact key path(s) instead of
+                // delivering a sanitized result. Routes to the catch below → a
+                // primitive-only {type:'error'} the pool reports, failing CI.
+                const detail = skipped.map((s) => `${s.path}: ${s.reason}`).join('; ');
+                throw new Error(`GITNEXUS_STRICT_CLONE: worker result was not structured-cloneable — ${detail}`);
+            }
+            result.skippedPaths = [...(result.skippedPaths ?? []), ...skipped];
+            const sample = skipped
+                .slice(0, 5)
+                .map((s) => `${s.path} (${s.reason})`)
+                .join('; ');
+            const more = skipped.length > 5 ? ` …and ${skipped.length - 5} more` : '';
+            if (parentPort) {
+                parentPort.postMessage({
+                    type: 'warning',
+                    message: `Sanitized ${skipped.length} file(s) with non-serializable parse output before delivery: ${sample}${more}`,
+                });
+            }
+        }
+        parentPort.postMessage({ type: 'result', data: result });
+    }
+    catch (err) {
+        const e = err instanceof Error ? err : new Error(String(err));
+        parentPort.postMessage({ type: 'error', error: e.message, errorStack: e.stack });
+    }
+}

package/dist/core/ingestion/workers/result-merge.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Merge of accumulated parse-worker results (sub-batch result → the conceptual
+ * job's running accumulator).
+ *
+ * Extracted from `parse-worker.ts` into this side-effect-free module so the
+ * merge can be imported and unit-tested directly — the parse worker is an entry
+ * module (importing it constructs the parser, posts `ready`, and attaches the
+ * real MessagePort handler), so a main-thread test cannot import a helper out of
+ * it. Mirrors the `post-result.ts` extraction.
+ *
+ * `import type` of `ParseWorkerResult` is erased at runtime, so there is no
+ * import cycle with `parse-worker.ts` (which imports this module's runtime).
+ */
+import type { ParseWorkerResult } from './parse-worker.js';
+/**
+ * Merge `src` into `target` in place: append every boundary-crossing array,
+ * sum the per-language skip counts, union the clone-safety `skippedPaths`, and
+ * add the file count.
+ */
+export declare const mergeResult: (target: ParseWorkerResult, src: ParseWorkerResult) => void;

package/dist/core/ingestion/workers/result-merge.js

@@ -0,0 +1,43 @@
+// Use a loop instead of push(...spread) to avoid hitting V8's argument limit
+// when merging large result sets (push(...arr) calls apply() under the hood
+// and blows the stack when arr has >~65k elements).
+const appendAll = (target, src) => {
+    for (let i = 0; i < src.length; i++)
+        target.push(src[i]);
+};
+/**
+ * Merge `src` into `target` in place: append every boundary-crossing array,
+ * sum the per-language skip counts, union the clone-safety `skippedPaths`, and
+ * add the file count.
+ */
+export const mergeResult = (target, src) => {
+    appendAll(target.nodes, src.nodes);
+    appendAll(target.relationships, src.relationships);
+    appendAll(target.symbols, src.symbols);
+    appendAll(target.calls, src.calls);
+    appendAll(target.assignments, src.assignments);
+    appendAll(target.routes, src.routes);
+    appendAll(target.fetchCalls, src.fetchCalls);
+    appendAll(target.fetchWrapperDefs, src.fetchWrapperDefs);
+    appendAll(target.decoratorRoutes, src.decoratorRoutes);
+    if (src.routerIncludes)
+        appendAll(target.routerIncludes, src.routerIncludes);
+    if (src.routerImports)
+        appendAll(target.routerImports, src.routerImports);
+    if (src.routerModuleAliases) {
+        target.routerModuleAliases ??= [];
+        appendAll(target.routerModuleAliases, src.routerModuleAliases);
+    }
+    appendAll(target.toolDefs, src.toolDefs);
+    appendAll(target.ormQueries, src.ormQueries);
+    appendAll(target.constructorBindings, src.constructorBindings);
+    appendAll(target.fileScopeBindings, src.fileScopeBindings);
+    appendAll(target.parsedFiles, src.parsedFiles);
+    for (const [lang, count] of Object.entries(src.skippedLanguages)) {
+        target.skippedLanguages[lang] = (target.skippedLanguages[lang] || 0) + count;
+    }
+    if (src.skippedPaths && src.skippedPaths.length > 0) {
+        (target.skippedPaths ??= []).push(...src.skippedPaths);
+    }
+    target.fileCount += src.fileCount;
+};

package/dist/core/ingestion/workers/worker-pool.d.ts

@@ -1,30 +1,4 @@
 import { Worker } from 'node:worker_threads';
-/**
- * Build the sub-batch dispatch payload + transferList.
- *
- * For the parse-worker shape `{path, content: string}[]`, encodes each
- * file's content as a `Uint8Array` via `TextEncoder` so the underlying
- * `ArrayBuffer` can be transferred zero-copy. For any other input
- * shape, the items array is passed through verbatim (no transfer).
- *
- * @internal Exported for the unit test suite
- * (`test/unit/worker-pool-transferlist.test.ts`) so the
- * Uint8Array-per-content allocation contract can be pinned without
- * spinning up a real worker_threads.
- */
-export declare function buildDispatchMessage<T>(items: readonly T[]): {
-    message: {
-        type: 'sub-batch';
-        files: Array<{
-            path: string;
-            content: Uint8Array;
-        }>;
-    } | {
-        type: 'sub-batch';
-        files: readonly T[];
-    };
-    transferList?: ArrayBuffer[];
-};
 export interface WorkerPool {
     /**
      * Dispatch items across workers. Items are split into bounded jobs, each job
@@ -152,6 +126,15 @@ export interface WorkerPoolOptions {
      * `undefined` ⇒ no durable write.
      */
     durableParsedFileStoragePath?: string;
+    /**
+     * CFG/PDG opt-in (#2081 M1). Baked into every spawned worker's `workerData`
+     * (like the store paths above); when `true`, workers build a per-function
+     * control-flow graph from the tree-sitter AST and attach it to
+     * `ParsedFile.cfgSideChannel`. `undefined`/`false` ⇒ no CFG work.
+     */
+    pdg?: boolean;
+    /** Per-function source-line cap for worker-side CFG construction (0 ⇒ no cap). */
+    pdgMaxFunctionLines?: number;
 }
 export declare class WorkerPoolDispatchError extends Error {
     /**
@@ -201,20 +184,6 @@ export declare class WorkerPoolInitializationError extends WorkerPoolDispatchErr
 export declare class WorkerPoolDisabledError extends Error {
     constructor(message: string);
 }
-/**
- * Normalize a worker crash message into a stable signature so two instances of
- * the SAME deterministic crash compare equal while unrelated crashes don't.
- * Strips hex addresses, digit runs (pids / line numbers / timestamps) and
- * absolute paths. Best-effort by design: the deterministic classification's
- * correctness rests on the STRUCTURAL signal (zero workers ever ready + startup
- * budget exhausted), so an imperfect signature only changes how fast the
- * short-circuit fires, never whether the pool ultimately fails fast. Even a
- * stderr-less crash normalizes its "exited with code N" message to a stable
- * key, so the empty-stderr timing case still groups.
- *
- * @internal Exported for unit tests; production callers are in this module.
- */
-export declare function crashSignature(message: string): string;
 interface ResolvedWorkerPoolOptions {
     subBatchSize: number;
     subBatchMaxBytes: number;
@@ -273,6 +242,12 @@ export declare function resolveAutoPoolSize(): number;
  *   time spent across all attempts/splits/retries. When the budget is
  *   exhausted, the pool surfaces the in-flight path via `WorkerPoolDispatchError`
  *   instead of letting timeouts compound indefinitely.
+ *
+ * Upstream of these layers, the parse worker self-sanitizes a result that the
+ * structured-clone algorithm can't serialize (#2112) — stripping or dropping
+ * the offending value and reporting the affected paths on the result — so a
+ * single non-cloneable value can't masquerade as a worker death and exhaust a
+ * slot's respawn budget here.
  */
 export declare const createWorkerPool: (workerUrl: URL, poolSize?: number, options?: WorkerPoolOptions) => WorkerPool;
 export {};

package/dist/core/ingestion/workers/worker-pool.js

@@ -523,6 +523,12 @@ function createJobs(items, maxItems, maxBytes, timeoutMs, chunkHash) {
  *   time spent across all attempts/splits/retries. When the budget is
  *   exhausted, the pool surfaces the in-flight path via `WorkerPoolDispatchError`
  *   instead of letting timeouts compound indefinitely.
+ *
+ * Upstream of these layers, the parse worker self-sanitizes a result that the
+ * structured-clone algorithm can't serialize (#2112) — stripping or dropping
+ * the offending value and reporting the affected paths on the result — so a
+ * single non-cloneable value can't masquerade as a worker death and exhaust a
+ * slot's respawn budget here.
  */
 export const createWorkerPool = (workerUrl, poolSize, options) => {
     // Validate worker script exists before spawning to prevent uncaught
@@ -544,13 +550,26 @@ export const createWorkerPool = (workerUrl, poolSize, options) => {
     // signature is unchanged so the zero-arg test factories keep working.
     const parsedFileStoreStoragePath = options?.parsedFileStoreStoragePath;
     const durableParsedFileStoragePath = options?.durableParsedFileStoragePath;
-    const workerStoreData = parsedFileStoreStoragePath || durableParsedFileStoragePath
-        ? { parsedFileStoreStoragePath, durableParsedFileStoragePath }
+    // CFG/PDG opt-in (#2081 M1) — carried in workerData alongside the store paths.
+    const pdg = options?.pdg === true;
+    const pdgMaxFunctionLines = options?.pdgMaxFunctionLines;
+    const workerStoreData = parsedFileStoreStoragePath || durableParsedFileStoragePath || pdg
+        ? { parsedFileStoreStoragePath, durableParsedFileStoragePath, pdg, pdgMaxFunctionLines }
         : undefined;
     const spawnWorker = options?.workerFactory ??
         ((url) => new Worker(url, {
             stderr: true,
             workerData: workerStoreData,
+            // The CFG visitors build per-function control-flow graphs by RECURSIVE
+            // descent over the tree-sitter AST, so deeply-nested source overflows
+            // the worker thread's call stack. A worker's stack is governed by
+            // `resourceLimits.stackSizeMb` (Node default 4 MB) — the main process's
+            // `--stack-size` flag does NOT propagate to worker threads — so raise it
+            // here. This pushes the overflow threshold from ~1.5k to several-k
+            // nesting levels (far beyond any hand-written code); a deeper machine-
+            // generated nest is still caught per-function (buildFunctionCfg's R4
+            // try/catch) and only that function's PDG is skipped, never a crash.
+            resourceLimits: { stackSizeMb: 16 },
         }));
     /** Spawn + wire stderr capture in one step (used by all spawn sites). */
     const spawnAndCapture = (url) => {
@@ -1313,14 +1332,19 @@ export const createWorkerPool = (workerUrl, poolSize, options) => {
                     if (settled || stopped)
                         return;
                     // Native postMessage delivers POJO directly via Node's
-                    // structured clone. V8 deserialization failures (malformed
-                    // frame, non-cloneable value) surface as a `messageerror`
-                    // event handled below — they never reach this handler. The
-                    // only thing we need to guard for here is a worker that
-                    // sends a message without a `type` discriminant (a bug in
-                    // the worker, not a wire-format issue): without the guard
-                    // `null.type` would throw a TypeError out of the
-                    // EventEmitter listener → uncaughtException on the main
+                    // structured clone. Two distinct clone failure modes exist,
+                    // and NEITHER reaches this handler: (1) a SENDER-side
+                    // non-cloneable value (a function/symbol that leaked into the
+                    // result) throws a synchronous `DataCloneError` on the
+                    // worker's own postMessage — the parse worker self-sanitizes
+                    // such results before delivery (#2112) and falls back to a
+                    // primitive-only `{type:'error'}` if it still can't serialize;
+                    // (2) a RECEIVER-side deserialization failure surfaces as a
+                    // `messageerror` event handled below. The only thing THIS
+                    // handler guards is a worker that sends a message without a
+                    // `type` discriminant (a worker bug, not a wire-format issue):
+                    // without the guard `null.type` would throw a TypeError out of
+                    // the EventEmitter listener → uncaughtException on the main
                     // thread.
                     const msg = raw;
                     if (msg === null || typeof msg !== 'object' || typeof msg.type !== 'string') {
@@ -1417,12 +1441,15 @@ export const createWorkerPool = (workerUrl, poolSize, options) => {
                             `Likely OOM or native addon failure${inFlightSuffix}.`, excludes);
                     }
                 };
-                // `messageerror` fires when V8 fails to deserialize a postMessage
-                // payload (e.g., the worker tries to send a non-cloneable value
-                // back, or structured-clone hits an unsupported shape). The worker
-                // stays ALIVE but the message is lost — without this handler the
-                // pool would sit on the dropped message until the idle timeout
-                // expires. Treat it as worker death so the resilience layers fire:
+                // `messageerror` fires when V8 fails to DESERIALIZE a postMessage
+                // payload on THIS (receiver) side — a value that serialized on the
+                // worker but can't be reconstructed here. (A non-cloneable value on
+                // the SENDER side instead throws a synchronous DataCloneError on the
+                // worker's own postMessage; that path is caught and sanitized
+                // worker-side (#2112) and never arrives here.) The worker stays ALIVE
+                // but the message is lost — without this handler the pool would sit on
+                // the dropped message until the idle timeout expires. Treat it as
+                // worker death so the resilience layers fire:
                 // requeue the remainder via `recoverAndResume`, attribute the
                 // in-flight file from the `starting-file` signal (if observed),
                 // and let the per-slot respawn budget and circuit breaker decide